qa iteration 3

Fresh-DB bootstrap fixes enabling 25/25 pages zero HTTP errors:
- Fix shared.tenants schema mismatch (missing is_default column in init script 16)
- Align migration 000 column set with init script (superset for all modules)
- Seed Authority tenant + stella-ops-ui OAuth client in init script 04
- Widen Platform auth bypass to cover Docker (172.0.0.0/8) and localhost (127.0.0.0/8)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

devops/compose/postgres-init/16-release-full-schema.sql

@@ -10,6 +10,7 @@ CREATE TABLE IF NOT EXISTS shared.tenants (
     tenant_id TEXT NOT NULL UNIQUE,
     name TEXT NOT NULL,
     display_name TEXT,
+    is_default BOOLEAN NOT NULL DEFAULT false,
     status TEXT NOT NULL DEFAULT 'active',
     settings JSONB NOT NULL DEFAULT '{}',
     metadata JSONB NOT NULL DEFAULT '{}',
@@ -17,6 +18,10 @@ CREATE TABLE IF NOT EXISTS shared.tenants (
     updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
+CREATE UNIQUE INDEX IF NOT EXISTS uq_shared_tenants_single_default
+    ON shared.tenants (is_default)
+    WHERE is_default;
+
 -- Seed shared tenant for local dev
 INSERT INTO shared.tenants (tenant_id, name, display_name, status)
 VALUES ('demo-prod', 'Production', 'Demo Production', 'active')